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Description 

Protective device suitable for cascade circuits and 
corresponding method for safety-related switching 

The present invention relates to a protective device for 
safety-related switching of an electrical unit having a first 
input for the purpose of receiving a switch-off signal, a 
second input for the purpose of receiving a switch-on signal in 
the form of a switch-on pulse, and an output for the purpose of 
driving the electrical unit. Furthermore, the present invention 
relates to a corresponding method for safety-related switching 
of an electrical unit. 

In safety-related systems and devices, an emergency- stop 
pushbutton can be provided for the purpose of switching the 
system or device. Shutdown takes place by means of a safety 
device or protective device. Figure 1 illustrates such a system 
in the form of a block diagram. The protective device 1, which 
may also be referred to as an emergency- stop device, has a 
multichannel input, via which it receives an emergency- stop 
signal from an emergency- stop pushbutton 2. Furthermore, the 
protective device 1 has a second input, via which a switch-on 
signal from an on pushbutton 3 can be received. This on 
pushbutton 3 is in the form of a normally open pushbutton. The 
protective device 1 drives an actuator 4, for example a 
contactor. The actuator 4 for its part switches a load contact 
5 and, at the same time, a monitoring contact 6. In the non- 
active state of the actuator 4, the load contact 5 is open and 
the monitoring contact 6 is closed. 

In accordance with the European safety standard EN 954, for 
category 4 an automatic restart should not take place after an 
emergency stop on a safety device once the cause of the 
emergency stop has been eliminated. This means that, once an 
emergency- stop pushbutton has been pressed, it first needs to 
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be latched again for reconnectidn purposes. In this case, the 
device does not yet start. It is only 
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when an on pushbutton is actuated that the output (s) is/are 
released and the device starts up. In addition, for category 4 
of this safety standard EN 954, monitoring of the actuators 
needs to be provided, i.e. monitoring contacts 6 of the 
emergency- stop device 1 or the connected actuator 4 need to be 
introduced into the on-pushbutton circuit. As a result, faults 
on the actuator 4 can be recognized. If, for example, the load 
contact 5 of a contactor is welded owing to an overload, the 
monitoring contact 6 is open even if the contactor is not 
activated. This means that the on-pushbutton circuit is. 
interrupted and a reconnection is prevented. 

For category 4 of the safety standard EN 954, it is also 
prescribed that evaluation of the on-pushbutton circuit needs 
to be edge-sensitive. In particular, the falling edge or both 
edges of a switch-on pulse need to be detected. As a result, 
undesired restarting of an electrical device, for example, 
owing to a cross-connection at the inputs or outputs of the 
emergency- stop device 1 can be prevented. 

In the case of relatively large systems, for example a conveyer 
belt, two or more emergency- stop pushbuttons can be provided. 
In this case, the associated protective devices are connected 
in cascade fashion, as illustrated in figure 2. The fundamental 
design of each circuit group corresponds to that in figure 1. 
For reasons of clarity, only two stages of a cascade are 
illustrated in figure 2, each stage having a protective device 
or emergency- stop device or an emergency- stop pushbutton. The 
first emergency- stop device 11 is connected to a two-channel 
emergency- stop pushbutton 12, 12'. This in turn likewise drives 
two actuators or contact multipliers 14 and 14' so as to adhere 
to category 4 of the safety standard EN 954. The actuators 14 
and 14' actuate monitoring contacts 16 and 16', which are 
connected in series and form, with an on pushbutton 13, an on- 
pushbutton circuit, for example from an external supply voltage 
source (24 V) to the emergency- stop device 11. 
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In addition, in each case twcr twin load contacts 15 and 15' are 
actuated with the aid of the actuators 14 and 14'. These twin 
load contacts 15 and 15' form, together with a two-channel 
emergency- stop pushbutton 22, 22', an emergency- stop circuit at 
the second emergency- stop device 21. This likewise drives two 
actuators or contact multipliers 24 and 24' which, for their 
part, actuate monitoring contacts 26 and 26' and twin load 
contacts 25 and 25'. The monitoring contacts 26 and 26' form, 
with an on pushbutton 23, the on-pushbutton circuit of the 
emergency- stop device 21. The cascading can be continued 
correspondingly as desired at the twin load contacts 25 and 25'. 

The way in which this cascade circuit functions will be 
described below. If the emergency- stop pushbutton 12, 12' is 
actuated at the first emergency- stop device 11, the actuators 
14, 14' of the emergency- stop device 11 are de-energized. The 
load contacts 15, 15' of these actuators 14, 14', which are 
incorporated in the emergency- stop circuit of the emergency- 
stop device 21, are thus also opened. As is already the case in 
the emergency- stop circuit of the emergency- stop device 11, 
this leads to an interruption in the emergency- stop circuit of 
the emergency-stop device 21. The actuators 24 and 24' of the 
emergency- stop device 21 are therefore also switched off. As a 
result, all of the load circuits in the cascade are switched 
off. 

If only the emergency- stop pushbutton 22, 22' is actuated, only 
the actuators 24, 24' of the emergency- stop device 21 are de- 
energized. The load monitoring contacts 26, 26' and the twin 
load contacts 25, 25' are therefore also de-energized. As a 
result, all of the downstream load circuits in the cascade are 
switched off. The actuators 14, 14' of the emergency- stop 
device 11 remain active. 
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In order to switch the load 'circuits on again, the emergency- 
stop pushbutton 12, 12' of the emergency- stop device 11 is 
latched again, i.e. the emergency- stop circuit is in a closed 
state. At this point in time, the load circuits are not yet 
complete, however. For this, the on pushbuttons 13 and 23 also 
need to be 
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actuated. If the on pushbutton 23 at the emergency- stop device 
21 is actuated first, the emergency- stop device 21 does not 
switch its actuators 24, 24' on since the actuators 14, 14' of 
the emergency-stop device 11 still interrupt the emergency- stop 
circuit of the emergency- stop device 21. In order to switch the 
load circuits on again, initially the on pushbutton 13 of the 
emergency- stop device 11 therefore needs to be actuated. 
Thereupon, the actuators 14, 14' of the emergency- stop device 
11 are driven and the emergency- stop circuit of the emergency- 
stop device 21 is closed. Only now can the emergency- stop 
device 21 be started by actuating its on pushbutton 23. This 
means that a prescribed sequence needs to be maintained for 
actuating the on pushbutton. However, such an inconvenient 
operating method for systems is unsuitable in industry. 

The object of the present invention therefore consists in 
proposing a protective device or protective system and a 
corresponding method for safety-related shutdown of an 
electrical unit, which device or system and method make 
operation of more complex systems more convenient. 

This object is achieved according to the invention by a 
protective device for the safety-related shutdown of an 
electrical unit having a first input for the purpose of 
receiving a switch-off signal, a second input for the purpose 
of receiving a switch-on signal in the form of a switch-on 
pulse, and an output for the purpose of driving the electrical 
unit and by a pulse processing device for the purpose of 
setting the protective device to an activation state, in which 
it can be switched on when the switch-off signal is not 
applied, for a predetermined period of time from reception of 
the switch-on pulse. 

In addition, the invention provides a method for safety-related 
switching of an electrical unit by means of receiving a switch- 
off signal, switching the electrical unit off, receiving a 



PCT/EP2004/007797 - 4a - 

2003P07193WOUS 

switch-on signal in the form' of a switch-on pulse, and 
switching the electrical unit on, it being possible to switch 
the electrical unit on only for a predeterminable 
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period of time after reception of the switch-on pulse. 

The switch-on signal preferably originates from an on 
pushbutton. The protective device thus receives a single 
switch-on pulse which generally has the binary form L-H-L. 

The switch-off signal generally originates from a latchable 
emergency- stop pushbutton. The emergency- stop pushbutton can 
thus not be closed unintentionally, which is of great 
importance in terms of safety. 

The electrical unit, which is switched by the protective 
device, may be an actuator and, in particular, a contactor. As 
a result, load circuits having relatively high currents can 
also be switched easily. 

The inputs and outputs of the protective device should have a 
plurality of channels. This is prescribed for category 4 of the 
safety standard EN 954 and increases the standard of safety. 

The falling edge or both edges of the switch-on pulse can 
advantageously be evaluated by the pulse processing device for 
the purpose of setting the protective device to the activation 
state. This edge sensitivity is likewise prescribed by the 
safety standard mentioned in order that no unintentional 
restarting of the emergency- stop device or protective device 
takes place as a result of cross-connection. 

In order to implement the temporally limited activation state, 
the pulse processing device can have a timing element which 
provides an acknowledgment command for the purpose of 
maintaining the activation state for a predetermined time after 
the switch-on pulse. The protective device can thus be switched 
on for a certain period of time after the switch-on pulse, as 
desired. According to the invention, response times of the 
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individual devices with respect 1 to one another can thus 
taken into account . 
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In this case, the period of 'tim'e for the activation state is 
preferably set such that it corresponds to the activation time 
of at least one electrical unit and/or at least one further 
switching device . 

Protective devices according to the invention are particularly 
advantageously connected to form a protective system in the 
form of a cascade. In this case, the first input of a second of 
the plurality of protective devices is driven by the output of 
one of the plurality of protective devices. This also applies, 
in the same manner, to the other cascade stages. The 
abovementioned period of time for the activation state is 
dimensioned for this purpose such that it is greater than the 
total of the response times of all of the protective devices. 
This protective system can be switched on by a common on 
pushbutton when the inputs of the plurality of protective 
devices are correspondingly connected. The units or systems 
connected by the protective devices can thus be switched on 
again in a convenient manner after an emergency- stop actuation. 

The present invention will be explained in more detail with 
reference to the attached drawings, in which: 

figure 1 shows a block diagram of a safety combination 

according to the prior art; 
figure 2 shows a block diagram of a plurality of cascaded 

safety combinations corresponding to the prior art; 
figure 3 shows a block diagram of cascaded safety combinations 

in accordance with the present invention, and 
figure 4 shows a block diagram of the on-pushbutton pulse 

evaluation according to the invention. 

The exemplary embodiments described below represent preferred 
embodiments of the present invention. 
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The intended use of the following embodiment is, as has been 
mentioned, for example, a conveyer belt, on which a plurality 
of emergency- stop 
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pushbuttons are mounted. However/ the conveyer belt should only 
be switched on after an emergency- stop actuation by an 
authorized person. For this purpose, for example a central on 
pushbutton is located at a control station, for example, a 
control cabinet. Figure 3 illustrates, in the form of a block 
diagram, a safety system suitable for this purpose having a 
plurality of emergency- stop devices in a cascade circuit having 
a common on pushbutton. The design is essentially the same as 
that in figure 2, with the result that reference is made to the 
description relating to figure 2 with respect to the same 
elements. One difference from the embodiment in figure 2 is the 
fact that, in the exemplary embodiment in figure 3, only a 
single on pushbutton 33 is used which provides an on pulse for 
all of the protective devices or emergency- stop devices. Both 
the monitoring contacts 16 and 16' and the monitoring contacts 
2 6 and 26' are thus in the on-pushbutton circuit. 

If the emergency- stop devices 11 and 21 have a known design, it 
is not possible to implement the system according to category 4 
(monitored start /restart ) . The reason for this is the fact that 
the on-pushbutton pulse arrives at the downstream device 21 
before release (unlatching) of the emergency- stop circuit 15, 
22 or 15', 22' or the on-pushbutton circuit 26', 26, 16, 16', 
33 is interrupted. If the emergency- stop pushbutton 12, 12' is 
latched again, i.e. closed, for the purpose of connecting the 
system and the common on pushbutton 3 3 is actuated (L-H-L 
pulse) , although the first emergency-stop device 11 is switched 
on, the second emergency- stop device 21 cannot be switched on. 
This is because the emergency- stop circuit is still interrupted 
by the second emergency- stop device 21 at the time of the on- 
pushbutton pulse, because the actuators of the emergency- stop 
device 11 only respond to the on-pushbutton pulse after a 
certain response time. 

A very simple solution to this would consist in the plurality 
of emergency- stop devices being released by the common on 
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pushbutton being pressed a • 1 plurality of times. With two 
emergency- stop devices in cascade, 
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the on pushbutton would thus lieeti to be pressed twice in order 
to switch the system on again. If the emergency- stop 
accessories become more complex, however, small controllers can 
also be used which produce corresponding release pulses for the 
emergency- stop devices. However, this is associated with very 
high costs and is sometimes even impermissible, in particular 
in safety technology. 

Provision is now made according to the invention, by modifying 
the device- internal evaluation of the on-pushbutton pulse, for 
the two emergency- stop devices 11 and 21 to be switched on 
simultaneously with a single release command by the on 
pushbutton 33 and, in the process, for the required safety 
conditions for the emergency- stop circuits to be maintained. 

Figure 4 shows a block diagram illustrating the on pushbutton 
evaluation according to the invention. Accordingly, an on- 
pushbutton signal undergoes edge evaluation 40. In this case, 
the falling edge or both edges of the switch-on pulse are 
evaluated in accordance with the required safety standard. A 
corresponding binary signal 401 is made available to a pulse 
processing device 41. Said pulse processing device 41 extends 
the switch-on pulse to a predetermined acknowledgment time by a 
timing element being started. This results in an internal 
acknowledgment command 411 for the further safety logic which 
is provided for a specific time, for example 500 ms . This 
evaluation of the on-pushbutton pulse is carried out 
continuously, even if there is no emergency stop at that time. 
If the emergency- stop circuit is then closed within this 
acknowledgment time, the output is driven via the safety logic, 
and the device to be switched is switched on again. 

This pulse processing according to the invention results in the 
following operational sequence for the circuit in figure 3: the 
two emergency- stop pushbuttons 12, 12' and 22, 22' are already 
closed again in order to switch the device or the system on 
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again. The on pushbutton 33 ife actuated, as a result of which 
the L-H-L pulse 401 
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known from figure 4 is generated-. The emergency- stop device 11 
switches on. At the same time, the acknowledgment time is also 
started in the emergency- stop device 21. Once the emergency- 
stop device 11 has closed both actuators 14, 14' after a 
specific response time, the emergency- stop device 21 recognizes 
a closed emergency- stop circuit 22, 22' , 15, 15' and likewise 
switches its actuators 24, 24' on on the basis of the 
acknowledgment command which is still present. If the 
emergency- stop device 11 does not switch its actuators 14, 14' 
on owing to a fault, the emergency- stop device 21 also does not 
switch its actuators 24, 24' on since in this case the 
emergency- stop circuit 22, 22', 15, 15' of the second 
emergency- stop device 21 is open. The internal acknowledgment 
command in the two emergency-stop devices 11 and 21 is then 
cancelled once the acknowledgment time has expired. 

The acknowledgment time is to be selected such that, at a 
desired cascading depth, the internal acknowledgment command is 
even after the individual response or activation times of the 
actuators and emergency- stop devices. This is particularly easy 
to realize in the case of electrical emergency- stop devices 
since their response times are short and thus the 
acknowledgment time may be short. If, on the other hand, the 
acknowledgment time is predetermined in the emergency- stop 
devices, only a certain cascading depth can be achieved 
depending on the response times of the individual devices. 
However, it is necessary to avoid cascading depths which are 
too great since the response time in the event of shutdown via 
the emergency- stop pushbutton brings about a considerable delay 
owing to the cascading. 

One further advantage results from the fact that all of the 
monitoring contacts 16, 16', 26, 26' are connected in series. 
If there is a fault in the downstream emergency- stop device 21 
or its actuator 24, 24' , the upstream emergency- stop device 11 
cannot be switched on again either. 



